fix(frontend): preserve Safari 16 markdown loading

[ichwars]

Summary

Closes #144.

• Replace the sole remark-gfm import with its four parsing extensions (tables, tasks, strikethrough, footnotes); remove the incompatible autolink dependency chain from the lockfile. Explicit Markdown/angle links and existing HTML/URL/opener protections remain; bare URLs/emails intentionally stay text.
• Set the production syntax target to Safari/iOS 16.0. Check actual output .js/.mjs files, including public assets and workers, for lookbehind literals, class static blocks and Unicode Sets. AST parsing avoids text/comment false positives and fails on empty/malformed output.
• Transform the PDF worker too, preserving its module exports for PDF.js's existing native-worker fallback. No commercial-domain behavior or PDF backend changes.
• Add a reproducible production README runtime check and run it in CI; regression tests cover Markdown/security and the native-worker failure path.

Verification

• Original production FileManager chunk: WebKit 16.0, Playwright 1.27.1 / build 1724 on Windows fails with Invalid regular expression: invalid group specifier name; same chunk imports in Chromium 149.
• New production output: 252 JavaScript files pass syntax guard. The guard rejects all three known old-build hazards (FileManager lookbehind, PDF chunk + raw PDF worker static blocks).
• New README flow in WebKit 16.0 and Chromium 149.0.7827.55, each 1440×1000 and 390×844: rendered content, GFM features, safe links/HTML, collapse/expand all pass; no relevant runtime/HTTP errors. Deterministic API fixtures exclude service workers and expected backend-less WebSocket errors.
• Full frontend coverage run passed; fresh GitHub CI confirms 3,057 tests in 269 suites, coverage thresholds passed (statements 50.22%, branches 46.46%, functions 41.95%, lines 51.27%). Focused Markdown/baseline/PDF tests: 21 passed.
• Real PDF production browser flows: 5 passed, including desktop autosave/release, mobile layout, ZUGFeRD, XRechnung, and native-worker fallback.
• TypeScript, ESLint, i18n parity, dependency boundaries, changed-source budgets and production npm audit (zero vulnerabilities) pass.
• Existing PDF e2e fixtures updated for encryption-status schema and the current page-heading location; no application workaround for obsolete tests.

Documentation / boundaries

docs/browser-compatibility.md, docs index and CHANGELOG document the user-visible bare-link change, reproducible commands and support limits. The companion wiki repository referenced by CONTRIBUTING could not be read (GitHub 404 for both README.md and mkdocs.yml); durable docs are included here. No website feature/marketing claims changed.

Safari 16 syntax/README compatibility is not full runtime support: PDF preview still requires a current PDF.js-supported browser, and no physical iOS device/offline-cache certification is claimed. Existing mobile toolbar overflow and historical Windows WebKit font rasterization are outside this parse fix.

Selective adaptation of upstream b3c67c6; no bulk merge. All work inline, no subagents. Pre-existing static/ changes excluded and preserved. GitHub CI/review must finish before merge.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-08T12:29:57.995367Z	6649566	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[ichwars]

Abschlussprüfung für 6649566b23c3d2316e6782b1e9239801a31b2c82: alle 24 GitHub-Jobs erfolgreich (CI 17, Security Audit 4, CodeQL 3), automatisches Review abgeschlossen ohne Befunde/offene Threads. Der finale Produktionscontainer-Test meldet 2.950 bestanden, 171 übersprungen, 4 Warnungen (824 s). Auch im Docker-Build besteht die Syntaxprüfung für alle 252 JavaScript-Dateien.

Frontend CI: 3.057 Tests in 269 Suites grün; realer Produktions-README-Flow in Chromium auf Desktop/Mobil grün. Lokal zusätzlich WebKit 16.0 Desktop/Mobil und fünf PDF-Browserfälle einschließlich nativem Worker-Fallback erfolgreich. GitHub-Head und lokaler Head identisch, Base unverändert; keine aufgabeneigenen uncommitteten Änderungen. Vorhandene static/-Benutzeränderungen unverändert und ausgeschlossen.

Merge erfolgt gemäß bestehender Freigabe nach bestandenen Tests; #144 wird damit geschlossen. #145 ist bereits lesend reproduziert und dokumentiert.